Cross-Network NRF Authentication Using Roaming CCA Headers
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
There is no defined mechanism for authenticating between Network Function Repository Functions (NRFs) across different networks, particularly in roaming scenarios, leading to security risks due to implicit authentication via Security Edge Protection Proxies (SEPPs) in 5G and other networks.
Innovation Solution
Implementing a roaming client credentials assertion (CCA) header with CCA claims to authenticate access token requests between NRFs, using a public key certificate, digital signature, and timestamp verification to ensure direct authentication between NRFs.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If implicit authentication via SEPPs is used for NRF communications across different networks, then device complexity is reduced, but security reliability deteriorates due to lack of direct authentication between NRFs
Solution Approach 1:
The patent introduces an explicit authentication mechanism using digital certificates and signatures as an intermediary layer between NRFs. The sending NRF attaches its certificate and signature to the request message, and the receiving NRF verifies these credentials through a dedicated validation process. This intermediary authentication layer resolves the contradiction by providing direct security verification between NRFs without replacing the existing SEPP infrastructure, thus maintaining operational simplicity while enhancing security reliability.
2Reliability
If explicit authentication with CCA header is implemented between NRFs, then authentication security is improved, but message processing complexity increases
Solution Approach 1:
The patent applies preliminary action by pre-configuring NRFs with digital certificates and public keys before authentication is needed. The sending NRF prepares the CCA header with its certificate and digital signature in advance, attaching these credentials to the request message before transmission. The receiving NRF has pre-loaded verification credentials to validate the signature. This preliminary preparation reduces real-time processing complexity during actual authentication operations, as the heavy cryptographic operations are performed beforehand.
3Reliability
If digital signature verification is performed on all incoming messages from other NRFs, then message integrity is improved, but processing time increases
Solution Approach 1:
The patent implements partial verification action by focusing digital signature verification only on the CCA header portion of the message that contains authentication credentials, rather than verifying the entire message payload. The receiving NRF validates the signature on the critical authentication data (certificate and signature fields in the CCA header) while processing the rest of the message content in parallel. This selective verification approach maintains message integrity for the critical authentication portion while reducing overall processing time through parallel execution.
Data Source
AI summary
A method for authenticating between network function (NF) repository functions (NRFs) across different networks includes receiving, at an NRF in a first network, a request message from an NRF in a second network separate from the first network. The method further includes determining, by the NRF in the first network, that the request message includes a roaming client credentials assertion (CCA) header. The method further includes, in response to determining that the request message includes a roaming CCA header, reading contents of the header. The method further includes authenticating the request message using the contents of the roaming CCA header. The method further includes, in response to successful authentication of the request message, generating a response message to the request message and transmitting the response message to the NRF in the second network.